Privacy Notice
1. Data Controller
Theparty responsible for the processing of your personal data is the legal entity ZORYATELECOM, S.A. DE C.V. (hereinafter, “Zorya”), with a domicile tohear and receive any type of notice located at Lago Ginebra número 86, oficinaA608, Colonia Cuauhtémoc Pensil, Alcaldía Miguel Hidalgo, Código Postal 11490,Ciudad de México, México.
Zoryais committed to the protection of the personal data of the users,professionals, partners, suppliers, potential customers, legal representativesand other third parties with whom it maintains a legal or commercialrelationship, in strict compliance with the Federal Law on the Protection ofPersonal Data Held by Private Parties, published in the Official Gazette of theFederation on March 20, 2025 (hereinafter, the “Law”), and the otherprovisions that may be applicable.
2. Scope of Application of thePrivacy Notice
This Privacy Notice appliessolely to the processing that Zorya carries out in its capacity as controller,with respect to the personal data of the Users of the Platform, their legalrepresentatives, partners, suppliers, potential customers and other thirdparties with whom Zorya maintains a legal or commercial relationship.
This Privacy Notice does notapply to the personal data of the End Users or recipients of the communicationsthat the User sends through the Services. With respect to such personal data,the User acts as controller and Zorya solely as processor, processing it inaccordance with the User's documented instructions, for the provision of theServices and on the terms of the Data Processing Agreement executed for suchpurpose. It is for the User, in its capacity as controller, to make availableto its End Users the applicable privacy notice, to evidence the lawful basisfor the processing and to handle the rights that such data subjects exercise.
3. Availability of the PrivacyNotice
Youmay consult this Privacy Notice at any time on the website www.zorya.com., and may also requestit directly from Zorya through the email address legal@zorya.mx.
Zoryais committed to providing you with all the information necessary to ensure thatyou have full control over the processing of your personal data, as well asover the rights available to you under the Law.
Wordsidentified with an initial capital letter in this Privacy Notice and notexpressly defined herein shall have the meaning ascribed to them in the Termsand Conditions of Zorya's Platform.
Where personal data iscollected through electronic, optical or any other technological means, Zoryashall make available to the data subject, at that same moment, thecorresponding simplified privacy notice, which shall refer to thiscomprehensive Privacy Notice.
4. Services
Themain purpose for which Zorya processes your personal data is to provide youwith those services arising from the registration, activation, administrationand operation of your User Account on the Platform, as well as any otherservices related to the use of the website, applications, software andfunctionalities that Zorya makes available to you, or any other service thatyou voluntarily decide to acquire or contract (hereinafter and collectivelyreferred to as the “Services”).
5. Purpose
Zorya,in compliance with the principles of lawfulness, consent, information, quality,purpose, fidelity, proportionality and accountability provided for in the Law,only collects and makes legitimate use of the personal data that is adequate,necessary and relevant for the provision of the Services, as well as to fulfillthe processing purposes informed in this Privacy Notice.
Underno circumstances shall Zorya process the personal data for purposes differentfrom or incompatible with those informed in this Privacy Notice, nor shall itobtain data that exceeds the criteria of relevance and necessity indicatedabove.
6. Personal Data Subject toProcessing and Means of Collection
Thepersonal data described below shall be obtained through various lawful sources,including the following means of collection: (i) when the User completes itsAccount Request registration through the Platform; (ii) when it enters contactinformation on the website www.zorya.com;(iii) when it provides its data by email, SMS messages or other electronic,optical, audio, visual or any other technological means; and (iv) when itprovides its data directly and personally to Zorya.
These are necessaryfor the provision of the Services and comprise the following categories:
• Identification and contact data: full name, businessname and company or organization (where applicable), country, domicile, date ofbirth, telephone number, email address, image, official identification,description of the project for which the Services will be required and anyadditional information that the User voluntarily provides to Zorya.
• Data to evidence legal representation: in the case of legalentities, Zorya may collect name, date of birth, contact telephone number,official identification and any other information or documentation that, inaccordance with applicable legislation, is necessary to evidence the standing,legal capacity and authority of the representative.
• Employment data: position, workaddress, institutional email address and office telephone number.
• Demographic data: information relatingto the geographic location of the device from which the User accesses thePlatform.
• Billing data: the bankinginstitution to which the charge will be made, tax domicile, Federal TaxpayerRegistry (RFC) or its equivalent in accordance with the legislation applicableto you.
• Financial data: bank accountinformation and payment methods, where applicable.
Technical and locationinformation of the device from which the Services are accessed, browsing data,information voluntarily entered by the User on the Platform and any informationderived from the use of the Services.
Identification,authentication and contact data, as well as information necessary for identityverification or compliance with legal obligations, obtained through lawfulsources or from third parties with whom Zorya has entered into binding legalagreements.
The User grants itsconsent for Zorya to collect a copy of the receipts and documents related tothe personal data indicated above, as Zorya determines for the fulfillment ofthe purposes informed in this Privacy Notice.
7. Sensitive Personal Data
TheUser must refrain from entering sensitive personal data on the Platform or inany of the Services. Zorya does not require or request the processing ofsensitive personal data for the provision of the Services.
Inthe event that, exceptionally, the processing of sensitive personal data isnecessary, Zorya shall obtain the express written consent of the data subjectin accordance with Article 8 of the Law, and shall implement the correspondingenhanced security measures.
Likewise, the User undertakesto refrain from transmitting sensitive personal data through the messagingchannels that make up the Services, unless it has previously notified Zorya inwriting and has the express written consent of the corresponding data subjects.Zorya assumes no liability arising from the breach of this obligation by theUser.
8. Personal Data of ThirdParties
Zoryamay process identification and contact personal data of third parties when theUser provides them directly, whether for such third parties to be contacted asreferences, to evidence the legal representation of a legal entity, or for anyother matter related to the provision of the Services and the fulfillment ofthe legal obligations acquired by the User.
Byproviding such information, the User represents that it has duly informed andpreviously obtained the consent of the third-party data subjects for Zorya toprocess their personal data for the purposes indicated above.
9. Personal Data of Minors
Zoryadoes not collect information directly from minors. The Services and thePlatform are directed solely at persons of legal age with full legal capacity.
Wherenecessary and appropriate, the information of minors must be provided by theperson exercising parental authority or guardianship. In those cases in whichZorya identifies that a minor has provided their personal data without thecorresponding authorization, Zorya shall proceed to the immediate cancellationof such information.
10. Primary or NecessaryPurposes of the Processing
Zoryashall limit the use of the personal data mentioned in this Privacy Notice tocarry out those activities necessary for the development and fulfillment of theobligations that originate and arise from the Services, including but notlimited to the following purposes:
The purposes indicated in thissection are necessary for the existence, maintenance and fulfillment of thelegal relationship between Zorya and the User, and therefore their processingdoes not require the additional consent of the data subject:
• To check and verify the identity of the Userin its Account Request for the use of the Platform and the Services.
• To evidence the identity, standing and legalcapacity of the legal representative of legal entities.
• To create an account with username andpassword so that the User can access the Services on the Platform in accordancewith the Terms and Conditions.
• To personalize the functions of the User'saccount and to administer the legal relationship between Zorya and the User.
• To provide customer service to the Userregarding any functionality of the Platform and to respond to its requests,questions and comments.
• To maintain contact with the User by anyphysical or electronic means, including email, telephone calls, SMS messages orinstant messaging platforms, for any matter related to the Services.
• To carry out billing procedures and processpayments, where applicable, through the technological forms and mechanismsenabled for such purpose.
• To request ratings, reviews and feedback fromthe User regarding the Services provided.
• To handle and follow up on investigations,clarifications, requests for information, complaints and claims, as well asthose related to the identification, detection, prevention and combating ofconduct that could contravene the applicable regulations.
• To exercise the legal actions that Zoryaconsiders necessary for the proper defense of its interests, as well as for theprotection of its confidential information and intellectual property.
• To maintain and safeguard the security of thePlatform, the website and the Users themselves, through the implementation oftechnical, physical and administrative security measures.
• To identify potential unlawful conduct andcyberattacks, as well as to detect technical failures or errors in theprovision of the Services.
• To comply with the legislation and regulationsapplicable to Zorya, as well as to respond to the requests of competentauthorities in the cases legally provided for.
• To generate and carry out dissociation orsecrecy procedures for personal data, where applicable.
11. Secondary or VoluntaryPurposes of the Processing
Additionally, Zorya mayprocess your personal data for the following purposes that are notnecessary for the legal relationship with the User, but that enable Zorya toimprove the Services and the user experience:
• Generatestatistics and market analysis, based on previously dissociated data, for the purpose of updating,improving and developing the Platform and the Services. This purpose does notcomprise information derived from third-party platforms or services where theterms applicable to such platforms restrict its use.
• Commercialcommunications: to informthe User about new products, functionalities, promotions, content and events ofZorya.
• Surveysand studies: to invitethe User to participate in satisfaction surveys, market studies and feedbackprograms of Zorya.
Opt-out mechanism. If you do not wish for your personal data to beprocessed for any or all of the secondary purposes indicated above, you mayexpress this by sending your request to the email address legal@zorya.mx,indicating your full name, the account or legal relationship concerned and thepurposes with respect to which you express your objection. The objection to theprocessing of your personal data for secondary purposes may not be grounds forZorya to deny you the Services nor shall it affect the existing legalrelationship.
You have a period of five (5)business days, counted from when this Privacy Notice is made available to you,to express such objection. The absence of an expression within such periodshall be understood as tacit consent for the secondary purposes, withoutprejudice to your ability to express your objection at any later time.
12. Use of Cookies, Web Beaconsand Similar Technologies
Zorya's website and Platformuse cookies, web beacons and other similar technologies that allow theautomatic collection of technical and browsing information, such as the type ofbrowser and operating system, the pages consulted, the IP address, the durationof the session and the User's configuration preferences.
Such information is used forthe following purposes: (i) to enable the operation and security of the User'ssession; (ii) to remember its configuration preferences; (iii) to measure theperformance of the website and the Platform; and (iv) to generate usagestatistics.
You may disable or delete theuse of cookies at any time through your browser settings. Please note thatdisabling certain cookies may prevent the proper functioning of somefunctionalities of the Platform.
13. Remissions of Personal Datato Processors
For the provision of theServices, Zorya relies on suppliers that process personal data on behalf of andin accordance with the documented instructions of Zorya, in their capacity asprocessors. Such communications constitute remissions and, by their nature, donot require the consent of the data subject nor are they considered transfers.
The categories of processorson which Zorya relies are the following:
• Providersof technology infrastructure, cloud computing, information hosting and backup.
• Providersof electronic invoicing, payment processing and collection services.
• Providersof technical support, help desk and User assistance.
• Providersof analytics, monitoring and information security tools.
• Providersof administrative, accounting and document management services.
Zorya enters into with eachprocessor a binding legal instrument that imposes on it confidentiality andpersonal data protection obligations no less protective than those set forth inthis Privacy Notice and in the Law, and is liable for the acts of suchprocessors as if they were its own. The current list of processors is availableto the User upon request to the email address legal@zorya.mx.
14. Transfers of Personal Data
Zorya may transfer yourpersonal data to the third parties and for the purposes indicated below:
• MetaPlatforms, Inc., Meta Platforms Ireland Limited and its affiliated companies (United States of America, Ireland and otherjurisdictions): for the delivery, routing, operation, security and integrity ofthe communications transmitted via WhatsApp Business API, in accordance withthe terms applicable to Zorya.
• GoogleLLC and its affiliated companies (United States of America and other jurisdictions): for the delivery,routing, operation and security of the communications transmitted via RCSBusiness Messaging, in accordance with the terms applicable to Zorya.
• Telecommunicationsoperators, mobile network concessionaires, carriers and integrators, domestic and foreign: for the routing and deliveryof SMS messages and other communications, as well as for the handling of senderidentification requirements.
• Companieswithin Zorya's corporate group, operating under the same internal processes and policies: foradministrative, accounting, support, information security and regulatorycompliance purposes.
• Externallegal, accounting and tax advisors and auditors: for the handling of matters related to the legalrelationship with the User, the defense of Zorya's interests and thefulfillment of its legal obligations.
• Competentadministrative, jurisdictional or judicial authorities: where the transfer is legally required, or isnecessary for the recognition, exercise or defense of a right in a judicial oradministrative proceeding.
• Third-partyacquirers or resulting companies: in the event of a merger, spin-off, acquisition, corporaterestructuring or total or partial sale of Zorya's assets, for the continuity ofthe legal relationship and of the Services.
Transfers that do not requireyour consent. Inaccordance with Article 36 of the Law, the consent of the data subject shallnot be required with respect to those transfers that, among other cases: (i)are necessary or legally required for the safeguarding of a public interest orfor the administration of justice; (ii) are necessary for the recognition,exercise or defense of a right in a judicial proceeding; (iii) are made tocompanies within Zorya's corporate group that operate under the same internalprocesses and policies; (iv) are necessary by virtue of a contract entered intoor to be entered into in the interest of the data subject, between Zorya and athird party; or (v) are necessary or legally required for the maintenance orfulfillment of the legal relationship between Zorya and the data subject.
The delivery of thecommunications that the User requests through the Services, and thecommunications that Zorya directs to the User in connection with them,constitute transfers necessary for the fulfillment of the legal relationshipexisting between Zorya and the data subject, under the case indicated in item(v) above.
Transfers that require yourconsent. With respect toany transfer that does not fall within any of the exceptions provided for inthe Law, your consent shall be required. If you do not express your objectionon the terms indicated below, it shall be understood that you grant your tacitconsent for such transfers.
To express your objection, youmay check the following box and submit it, or send your request to the emailaddress legal@zorya.mx:
[ ] Ido not consent to my personal data being transferred on the terms indicated inthis Privacy Notice, with respect to those transfers that require my consent.
In accordance with Article 35of the Law, Zorya shall communicate this Privacy Notice and the purposes towhich the data subject subjected its processing to the third-party recipients.The third-party recipient shall assume the same obligations that correspond toZorya as controller.
15. International Transfers andApplicable Safeguards
Some of the transfers andremissions indicated in this Privacy Notice involve the sending of personaldata to, or the access to it from, jurisdictions other than the United MexicanStates, including the United States of America, Ireland and those countries inwhich the recipients of the communications or Zorya's suppliers are located.
In such cases, Zorya adoptsadequate safeguards so that the personal data maintains a level of protectionequivalent to that provided for in the Law, through the execution of bindinglegal instruments with the recipients and, where applicable, through theadoption of internationally recognized standard contractual clauses, includingthe standard contractual clauses of the Ibero-American Data Protection Network.
16. Retention Period of thePersonal Data
Zorya shall retain yourpersonal data only for the time necessary for the fulfillment of the purposesindicated in this Privacy Notice and, once these are concluded, during theretention periods that are enforceable in accordance with tax, commercial, telecommunicationsand other applicable regulations, as well as during the limitation period ofthe actions that could arise from the legal relationship.
Once the purposes have beenfulfilled and the applicable retention periods have elapsed, your personal datashall be blocked for the sole purpose of determining possible liabilities inconnection with its processing, until the statutory or contractual limitationperiod thereof, and shall subsequently be deleted in accordance with thesecurity measures implemented by Zorya.
17. Security Measures
Zorya has implemented andmaintains reasonable and appropriate administrative, technical and physicalsecurity measures to protect your personal data against damage, loss,alteration, destruction, unauthorized use, access or processing, having regardto the type of data processed and the risks identified.
Such measures are integratedinto an Information Security Management System aligned with recognizedstandards, including ISO/IEC 27001, and comprise, but are not limited to: theencryption of information in transit, access controls based on profiles and onthe need-to-know principle, enhanced authentication mechanisms, audit logs,backup and recovery procedures, as well as confidentiality obligationsenforceable against all persons involved in any phase of the processing, whichsubsist even after the conclusion of the relationship with Zorya.
In the event that a securitybreach occurs that significantly affects the economic or moral rights of thedata subjects, Zorya shall inform the affected data subjects without delay and,as appropriate, the competent authority, as soon as it confirms that the breachoccurred and has initiated the actions aimed at the exhaustive review of themagnitude of the impact, so that the data subjects may take the measures theydeem appropriate.
18. ARCO Rights and Means toExercise Them
You, or your duly accreditedlegal representative, have the right to:
• Access: to know what personal data of yours is held by Zorya,as well as the information related to the conditions and general aspects of itsprocessing.
• Rectification: to request the correction of your personal data whenit is inaccurate, incomplete or not up to date.
• Cancellation: to request the deletion of your personal data whenyou consider that it is not being processed in accordance with the Law or thisPrivacy Notice.
• Opposition: to object to the processing of your personal data forspecific purposes, in the cases and with the limitations that the Lawestablishes.
The exercise of any of theARCO Rights is not a prerequisite for, nor does it prevent, the exercise ofanother.
Means to exercise them. Your request must be submitted to the email address legal@zorya.mx orto Zorya's domicile indicated in section 1 of this Privacy Notice, and mustcontain and be accompanied by:
• Thefull name of the data subject and the domicile or any other means tocommunicate the response to your request.
• Thedocuments that evidence your identity or, where applicable, the legalrepresentation of the data subject.
• Theclear and precise description of the personal data with respect to which youseek to exercise any of the ARCO Rights.
• Anyother element or document that facilitates the location of your personal data.
• Inthe case of the right of rectification, you must indicate the modifications tobe made and provide the documentation that supports your request.
Time periods. Zorya shall communicate to the data subject thedetermination adopted within a maximum period of twenty (20) business days,counted from the date on which the request is received, so that, ifappropriate, it shall be made effective within the fifteen (15) business daysfollowing the date on which the response is communicated. The referencedperiods may be extended once for an equal period, when the circumstances of thecase so justify.
No cost. The exercise of the ARCO Rights is free of charge.Only the justified shipping expenses or the cost of reproduction in copies orother formats may be charged. Where the data subject reiterates its requestwithin a period of less than twelve (12) months, the applicable costs shall beadjusted to that provided for in the Law, unless there are material amendmentsto this Privacy Notice that give rise to new consultations.
19. Revocation of Consent
You may revoke at any time theconsent that, where applicable, you have granted to Zorya for the processing ofyour personal data. To do so, you must submit your request to the email addresslegal@zorya.mx, complying with the same requirements indicated forthe exercise of the ARCO Rights. Zorya shall handle your request within thesame periods indicated in the previous section and shall inform you of themeans by which the revocation shall be made effective.
Please note that, in certaincases, the revocation of consent may not have immediate or total effects,whether because the Law or other regulations require the continuation of theprocessing, or because the personal data is necessary for the maintenance orfulfillment of the legal relationship between you and Zorya. In such cases,Zorya shall inform you of such circumstance in a founded and reasoned manner.
20. Limitation of the Use orDisclosure of Your Personal Data
Regardless of the exercise ofthe ARCO Rights and of the revocation of consent, you may request thelimitation of the use or disclosure of your personal data by request addressedto the email address legal@zorya.mx, indicating the use or disclosure that you wish tolimit.
If your request isappropriate, Zorya shall register you in its internal exclusion list, so thatyour personal data is not processed for the secondary purposes indicated inthis Privacy Notice. Zorya shall provide you with the correspondingregistration certificate.
Likewise, please note that youmay register your telephone number in the Public Registry of Consumers to AvoidAdvertising (REPEP), maintained by the Federal Consumer Protection Agency(PROFECO), available at the site repep.profeco.gob.mx, in order not to receiveadvertising from suppliers of goods, products or services.
21. Personal Data Department
Zorya has designated aPersonal Data Department, responsible for processing the requests for theexercise of ARCO Rights, revocation of consent and limitation of use ordisclosure, as well as for promoting the protection of personal data within theorganization.
You may contact it at theemail address legal@zorya.mx or at the domicile located at Lago Ginebra número 86,oficina A608, Colonia Cuauhtémoc Pensil, Alcaldía Miguel Hidalgo, Código Postal11490, Ciudad de México, México.
22. Competent Authority
If you consider that yourright to the protection of personal data has been harmed by any conduct oromission of Zorya, or you presume any violation of the provisions set forth inthe Law and other applicable regulations, you may file the corresponding complaintor remedy before the Ministry of Anti-Corruption and Good Governance(Secretaría Anticorrupción y Buen Gobierno), the competent authority regardingthe protection of personal data held by private parties. For more information,we suggest that you consult the official portal of such Ministry.
23. Amendments to the PrivacyNotice
Zorya reserves the right tomake, at any time, amendments or updates to this Privacy Notice, arising fromnew legal requirements, from needs of the Services themselves, from its privacypractices, from changes in its business model or for other causes.
Such amendments shall beavailable through the publication of the updated version of this Privacy Noticeon the website www.zorya.com.,indicating at all times the date of last update. In the case of materialamendments, Zorya shall additionally communicate this to you by notice sent tothe email address registered in your account or through the Platform, at leastfifteen (15) calendar days in advance of its entry into force.
Where the amendment involvesthe processing of your personal data for purposes different from those providedfor in this Privacy Notice, Zorya shall again obtain your consent in accordancewith the Law.
24. Consent
When you visit our website, orregister on the Platform, or complete your Account Request, or interact withour Services, you give us your consent for the processing of your personal datain accordance with this Privacy Notice.
This Privacy Notice havingbeen made available to you, if you do not express your will to the contrary itshall be understood that you grant your tacit consent for the processing ofyour personal data on the terms indicated herein.
In the case of sensitivepersonal data, Zorya shall obtain your express written consent, in accordancewith Article 8 of the Law. In the case of financial or asset-related personaldata, Zorya shall obtain your express consent.
Last Updated
July2026.
2026 Zorya by Everlay Group
